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Viacom International Media Networks (VIMN) welcomes the opportunity to respond to the ICO’s 
consultation on its proposed Code of Practice for Online Services. VIMN has been providing 
television services to UK audiences since 1987. We now own or part-own and operate more than 
25 TV channels in the UK attracting close to 12% of viewing among 16-34 year-olds, making us 
the third-biggest privately held broadcast media group in the UK market with over 1000 employees 
at our HQ in Camden town, London. Our channels offer the very best in music, comedy, kids and 
general entertainment programming through the Channel 5, MTV, Comedy Central and 
Nickelodeon brands. 


CONTEXT 


The purchase of Channel 5 in 2014 not only extended VIMN’s footprint into free-to-air, public 
service commercial television, it represented a step-change in our ambitions in the UK: to invest 
in more programming, to profit from the synergies between our pay and free channels, and to 
develop the UK as a creative hub for generating great content than can be shown around the 
world. 


Since its acquisition by Viacom, Channel 5 has undergone a radical transformation. Last year the 
channel was named Edinburgh Channel of the Year 2018, reflecting the benefits of a radical 
overhaul of its schedule and 40% increase in spend on original UK productions in peak-time since 
2014. Milkshake!, Channel 5’s pre-school brand, airs on the channel every day from 6-9am 
weekdays and 6-10am weekends, reaching more than half of all UK children. In 2018 it invested 
in 29 hours of new originated content for Milkshake!, equating to approximately 160 individual 
episodes. The channel aims to increase this figure to 50 new UK originated hours per year from 
2021, which will double production to over 300 individual episodes. As a result of this additional 
investment Milkshake! will be able to deliver a wider and more diverse range of UK-originated 
programming, as well as invest in new series of existing shows. 


Outside of linear transmission the VIMN family of brands have multi-faceted digital distribution 
models that include websites, games and apps alongside commercial partnerships with third- 
party platforms for distribution such as Sky, Virgin Media, Amazon Prime. Channel 5 has its own 
proprietary VOD service ‘My® that is a key destination for viewers to catch-up on their favourite 
shows and find new and exciting quality UK content. 
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Set out in the rest of this document are VIMN’s collated thoughts on the proposals set out in the 
Code of Practice for Online Services. 


SCOPE OF THE CODE 


VIMN appreciates that in order to make the protection of children a primary concern for digital 
services the ICO proposes making the code applicable to all Information Society Services (ISS) 
“likely to be accessed by children”’, including generic website and online streaming services. 
However, VIMN would observe that extending the restrictions to all ISS in this way is overly broad 
and places significant practical constraints on sites and services that are not offered to or intended 
for children, but which children could access. Indeed, the code places significant burdens on 
ISS’s that are not intended for or marketed to children, and for which the risk of encroaching on 
children’s rights from a data protection point of view are disproportionately low. Thus, the code 
stands in contrast to the risk-based approach to data protection embodied in the GDPR, which 
the code is intended to support. 


Additionally, broadening the age of application to all children under 18 has potentially expansive 
negative practical implications as older children have different needs than younger children, as 
recognized by the GDPR, which sets the age of digital consent at 16 (or as low as 13 depending 
on the Member State). 


The proposed scope will negatively impact VIMN’s ability to engage children with its diverse range 
of high quality kids brands through My5 and the respective digital services of Nickelodeon, NickJr, 
and Milkshake. Inhibiting the offering of UK kids content (due to its removal from mixed audience 
services) could be an unintended consequence of this approach. VIMN suggest the proposed 
scope should be amended to focus on services “offer[ing] information society services directly to 
a Child” as that term is used in Article 8 of the GDPR and provide factors that the ICO will consider 
in determining whether an ISS is offered directly to a child. 


The suggestion throughout the code that every provider of an ISS “carry out some market 
research, or refer to current evidence on user behaviour and the user base of existing services 
and service types,”* is not practical. As the code acknowledges, an ISS can serve numerous 
functions, such as providing information about an event or a film, providing a portal to access 
programming content, games, entry points for promotions and contests, and many more. Some 
sites or games are only available for a limited time, or are run under very limited budgets. As a 
result, many ISS’s would not be developed due to the cost and delay of conducting market 
research, especially where an ISS provider has a strong understanding of their intended 
audience. 


1 ICO 2019, ‘Age Appropriate Design Code: Draft Document’ of Practice for Online Services’, pp.13-14 
* Ibid. p.13 
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It should be noted that these services will already be compliant with the GDPR as it was 
implemented into UK law through the Data Protection Act 2018. A key question for the ICO in the 
final drafting of its code must be what current harm, post GDPR compliance, is it trying to address? 
The ICO should heed its own warning that where there is too restrictive an approach to an ISS 
offered to children, “Often the only choice in practice is to avoid online services altogether, which 
means the child loses the benefits of online play, interaction and development.” The code as 
currently proposed could chill innovation and development of services to children, including teens. 


Given the significant implications of the proposed scope of this code it should be noted that the 
short timeframe to respond to the consultation and the short period for businesses to ready 
themselves after we see the final code will present additional significant disruption to businesses 
and consumers. 


MEASURES FOR DISTINGUISHING AUDIENCES 


Whilst conceptually simple, the code’s application to all users unless robust age verification 
measures are in place? introduces additional complexity that could undermine the consumer 
experience and their privacy. 


VIMN is concerned that the safeguards outlined in the code being applied to all users is not 
practical or realistic, and will inhibit the development of ISSs intended for non-adult audiences. 
Further, the requirement that in order to verify the age of a user, an ISS provider must collect 
more data to make the verification does not comport with the concept of data minimization. 


So-called robust age verification measures would create a negative user experience by requiring 
all users to provide personal data before being able to access some Services or adjusting their 
privacy settings, and would entail delays pending the verification process. Such user friction would 
discourage adults from accessing |ISSs that are intended for a broad or mixed audience, or even 
services not intended for children, but which fall under this code because children may access 
them. 


In this context the proposed code could undermine efforts led by Ofcom, DCMS, and parliament 
to ensure the long-term viability of PSB. PSBs provide UK audiences with an extensive mix of 
UkK-originated, first-run programmes and services for free which the market would not otherwise 
provide. The huge range of programmes on offer through services such as My5 reflects the UK’s 
culture, diversity and values, and offers a place where viewers Know they can go to for trusted 
and accurate news, current affairs, documentaries and information. Strict compliance with this 
code as currently proposed could push consumers away from trusted media environments such 
as My5 towards less regulated and non-GDPR compliant illicit services. 


3 ICO 2019, ‘Age Appropriate Design Code: Draft Document’ of Practice for Online Services’, p. 23. 


VIMN Response to ICO Age Appropriate Design: Code of Practice for Online Services 


CREATING DIFFERENT USER EXPERIENCES 


In VIMN’s reading of the guidance, the code requires the user experience to be tailored to various 
age groups, suggesting that each ISS that gathers any age information must provide multiple 
experiences (standards for notices and privacy controls) for different aged children. Specifically 
five age bands: 0-5, pre-literate and early literacy; 6-9, core primary school years; 10-12, transition 
years; 13-15, early teen; and 16-17, approaching adulthood. Thus, every service likely to be 
accessed by children will require the collection of the child’s age to provide the appropriate 
experience for the child’s age group, including for those offered to preliterate children, who may 
not be able to understand or provide the data. 


The requirement to create multiple experiences and provide notices and prompts in multiple forms 
to accommodate all ages that may access an online service is not practicable. In essence, the 
code as proposed would require that ISS providers create five different experiences for each ISS, 
each with different verbiage, different options and controls, and potentially an entirely different 
user interface for each identified age band. In response, providers may tailor their ISSs for a 
narrow band of children rather than offer the services broadly, further limiting the available options 
for children, and inhibiting the ability for children to grow with a service. 


CONFLATING SAFEGUARDS FOR DATA PROTECTION WITH CHILDREN’S 
CONTENT 


VIMN is concerned that Section 4 of the code relating to “Detrimental Use of Data” and Section 5 
relating to “Policies and Community Standards” create an ambiguity between data processing 
activities and content offering functions. For example in Section 4, the code makes specific 
reference to the Committee of Advertising Practice (CAP) guidance, which relates to advertising 
restrictions, which, the ICO acknowledges, includes “ rules which govern or prohibit the marketing 
of certain products, such as high fat, salt and sugar food and drinks and alcohol, to children, and 
general guidance on transparency of paid-for content and product placement”. 


section 5 states that in order to comply with this section of the code, “If you make commitments 
to users about the content or other aspects of your online service then you need to have adequate 
systems in place to ensure that you meet those commitments...So if you say that the content of 
your online service is suitable for children within a certain age range then you need to have 
systems in place to ensure that it is.” Whilst both these statements are objectively correct, it is 
unclear why they are featured in the ICO guidance given TV-like and advertising content are not 
regulated by the ICO. 


Further, the code is ambiguous when assigning responsibility for content of third parties that may 
be recommended to children, stating, “Data protection law doesn’t make you responsible for third 
party content but it does make you responsible for what you ‘feed’ to children who use your 


4 ICO 2019, ‘Age Appropriate Design Code: Draft Document’ of Practice for Online Services’, p. 34. 
> Ibid. p. 41. 
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service, based upon your use of their personal data.” If not third party content, what is the ICO 
concerned that children might be fed? 


VIMN suggests that Section 4 and Section 5 of the code are clarified. The code must focus on 
data processing activities and not interpose other standards that are overseen and enforced by 
other regulatory and self-regulatory entities. It may lead to redundant regulation and inconsistent 
outcomes. Regulation of content (including advertising) is already governed by Ofcom and the 
ASA who enforce a number of self-regulatory codes, including the CAP Code and the BCAP code. 


To the extent the code makes an ISS provider responsible for third-party content, it is unnecessary 
and impractical. If a ISS offers access to third-party products or services, it seems improper to 
require the primary ISS provider to have vetted each piece of content for appropriateness. If this 
is not the intention of the ICO, VIMN would welcome further clarity on this point also. 


INCORPORATING CONSENT MECHANISMS 


The code requires the use of privacy settings, just-in-time notifications and “online tools,” which 
may be impractical, and which may require parental intervention or consent, but the code does 
not explain how to incorporate consent mechanisms into an ISS. 


Turning personalization off by default, as proposed, will set back the user experience for 
technology decades, making it more arduous and difficult for individuals to access the information 
or entertainment that they are currently accustomed to receiving nearly instantaneously. As the 
code seems to acknowledge, each end user will use an ISS differently, whether it is avatars 
chosen to represent one’s identity in a game, the type of content one views, or amount of time 
spent with the experience. Turning personalization off by default would inhibit the ability of the 
provider to give the end user their desired experience, and instead interpose additional steps to 
accomplish something users expect to be implicit in the experience. For consumers viewing a 
service provider that is GDPR compliant and is transparent about how the data is used, 
personalization will actually improve the user experience and should not be limited or prohibited 
by the code. 


Turning geolocation data off by default as described in the code, insofar as geolocation data refers 
to all location data, could cause significant impacts where regional or location-based services are 
concerned, or where there are contractual or IP limitations with respect to the geographies that 
certain content can be offered. The code should provide greater guidance about the level of 
specificity of geolocation data that should be turned off. Further, the code should allow the 
collection of general location data to allow for the provision of certain services that may be specific 
to a particular region or city. 


The code does not provide adequate guidance whether a child under 13 may engage with privacy 
settings and online tools without parental intervention, or whether such choices by the child 


6 Ibid. p. 65. 
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require parental consent (GDPR Article 8). Further, to the extent parental consent is required, the 
code does not provide any guidance as to how that parental consent can be sought or how the 
user experience would incorporate parental interventions or other mechanisms to obtain parental 
consent as required under Article 8 of the GDPR. 


PROPOSED USE OF DATA PROTECTION IMPACT ASSESSMENTS 


The code requires a DPIA for each processing activity of a child, including some form of market 
research or user testing’. Conducting DPIAs for all processing of children’s data seems 
unnecessary. Although it is not disputed that children merit special protections with respect to 
how their data is processed, a DPIA should only be required for higher risk processing activities. 
Requiring a DPIA for a processing activity that uses minimal data or has very low risk to the rights 
of the child (e.g., allowing a child to send a question by email or other method, where the child’s 
contact information is only used to respond to the question and then discarded) seems excessive 
relative to the risk. 


Further requiring the use of market research to support the processing activity in a DPIA is overly 
burdensome. Market research may be relevant in limited instances, such as with respect to a 
new or novel technology, or with respect to a new type of product offering. Commonplace data 
processing activities in connection with analytics or contests and promotions would not benefit 
from use of market research data, but would increase cost burdens on the service As stated 
above, market research on every child-related initiative is unnecessary and will not further the 
interest of protecting children from overly intrusive data processing activities. A provider of an 
ISS should be able to rely on its own understanding of its audience, and its ability to balance the 
potential risks of each activity. Market research can be employed where it will truly benefit the 
provider in building the service, but it should not be a requirement baked into each analysis. 


For further information please contact: Mitchell Simmons, Director, Government Relations 
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